Do you have to say you used AI?

Below are the four situations the law names, with what is and isn't required in each.

1. A chatbot on your site

Disclosure required. If someone is talking to an AI system, that person has to know it. The notice has to be clear at the first interaction.

Exception: where it is obvious from the context to a reasonably observant person. Don't lean on that for a chat window that looks like a conversation with an employee, because then it is precisely not clear.

In practice: one line at the top of the chat window is enough. Don't give your chatbot a human name with a profile photo, because then you are actively working against the requirement.

2. Images, audio and video that look real

Disclosure required if you use AI to create or edit images, audio or video that imitates an existing person, object or event and where someone could wrongly believe it is real.

For clearly artistic, satirical or fictional work a lighter form applies: you disclose it in a way that doesn't get in the way of the experience.

In practice: a generated photo of a shop that doesn't exist, used in an advertisement, should carry a note. A clearly stylised illustration on your blog is a different case.

3. Generated text

This is where the nuance most often goes wrong. The disclosure duty for text is limited to text published to inform the public on matters of public interest.

And there is an exception: if the text has been reviewed or edited by a person and someone carries editorial responsibility for it, the duty falls away.

In practice: the customer email you prepared with AI and read over yourself doesn't fall under this. Neither do your product copy and your newsletter. A news-like article on a societal subject that goes out unread does.

That doesn't mean you may not mention it. It means you don't have to act as though you must.

4. Emotion recognition and biometric categorisation

Disclosure required to the people concerned. Note here that emotion recognition in the workplace and in education is prohibited outright, so it stops there rather than at a disclosure duty.

Machine-readable marking

On top of the above, systems that produce synthetic content have to mark their output in a machine-readable way, for example with a watermark or metadata. That obligation sits with the provider of the system, so with the party supplying the model or the tool, not with you as a user.

For systems already on the market before 2 August 2026 there is a transition period until 2 December 2026.

What it costs if you don't

Breaching the transparency rules can run up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher. In practice a supervisory authority won't start there with a company of twenty people, but the power exists.

What you can do today

1. Walk your site looking for chat windows and generated imagery.
2. Check whether an AI assistant has customer contact anywhere without that being mentioned.
3. Record which published output AI plays a part in and who checks it.
4. Put that in your AI register, so you have the answer when someone asks.

Point four is exactly where it goes wrong once you have more than a handful of tools. That is what Building an AI register is about.